Threat Database Trojans Trojan.Betabot

Trojan.Betabot

By Domesticus in Trojans

Threat Scorecard

Threat Level: 80 % (High)
Infected Computers: 49
First Seen: February 27, 2013
Last Seen: April 11, 2023
OS(es) Affected: Windows

Trojan.Betabot is a Trojan that opens a back door on the corrupted PC. Once run, Trojan.Betabot replicates itself to the particular location on the affected computer system. Trojan.Betabot creates the registry entries that enable it to launch automatically every time you start Windows. Trojan.Betabot may also create and make modifications to other registry entries on the infected computer. Trojan.Betabot then modifies the Windows Registry to reduce Internet security settings. Trojan.Betabot creates a covered instance of the 'iexplore.exe' process and embeds a code into it. Trojan.Betabot then connects to one of the locations and opens a back door, which enables a remote cybercriminal to get full access and control of the attacked PC. Trojan.Betabot then terminates all applications with open windows that incorporate 'explorer.exe'.

SpyHunter Detects & Remove Trojan.Betabot

File System Details

Trojan.Betabot may create the following file(s):
# File Name MD5 Detections
1. %ProgramFiles%\Common Files\[Windows Licence Check].{2227A280-3AEA-1069-A2DE-08002B30309D}\[NINE RANDOM LOWER CASE CHARACTERS].exe
2. %ProgramFiles%\Common Files\[Flash Update Client].{2227A280-3AEA-1069-A2DE-08002B30309D}\[NINE RANDOM LOWER CASE CHARACTERS].exe
3. %ProgramFiles%\Common Files\[TROJAN FOLDER NAME].{2227A280-3AEA-1069-A2DE-08002B30309D}\[NINE RANDOM LOWER CASE CHARACTERS].exe
4. file.exe 9d9021fe1aa61e13e8190cccaec8f7fd 0
5. file.exe 964b98b3e6a2b30b388cc2a2543dee8d 0
6. file.exe 0f97c0600cb950fe9430023345529356 0
7. file.exe 4268720e55ae925de44e06cd3cfcaf65 0
8. file.exe f5a1184792b4ae7a32b32df2f78f856f 0

Registry Details

Trojan.Betabot may create the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"[TROJAN FOLDER NAME]" = "[PATH TO TROJAN EXECUTABLE]"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\[TROJAN FILE NAME]\"DisableExceptionChainValidation" = ""
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\TaskManager\"Task Service ID" = "[RANDOM HEXADECIMAL CHARACTERS]"
HKEY_ALL_USERS\.default\Software\Classes\CLSID\[RANDOM GUID]\[EIGHT HEXADECIMAL CHARACTERS]\CW1\"[THREE OR FOUR DIGITS]" = "[HEXADECIMAL CHARACTERS]"
HKEY_ALL_USERS\.default\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\"2500" = "3"
HKEY_ALL_USERS\.default\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\"2500" = "3"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\"2500" = "3"
HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\SSDPSRV\"Start" = "2"
HKEY_ALL_USERS\.default\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\"[TROJAN FOLDER NAME]" = "[PATH TO TROJAN EXECUTABLE]"
HKEY_ALL_USERS\.default\Software\Microsoft\Windows\CurrentVersion\Run\"[TROJAN FOLDER NAME]" = "[PATH TO TROJAN EXECUTABLE]"
HKEY_ALL_USERS\.default\Software\Microsoft\Windows NT\CurrentVersion\TaskManager\"Task Service ID" = "[RANDOM HEXADECIMAL CHARACTERS]"
HKEY_ALL_USERS\.default\Software\Win7zip\"Uuid" = "[RANDOM HEXADECIMAL CHARACTERS]"
HKEY_LOCAL_MACHINE\SOFTWARE\Win7zip\"Uuid" = "[RANDOM HEXADECIMAL CHARACTERS]"
HKEY_ALL_USERS\.default\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\"2500" = "3"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\"2500" = "3"
HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Update\Policy\"EnableJavaUpdate" = "0"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"[TROJAN FOLDER NAME]" = "[PATH TO TROJAN EXECUTABLE]"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\"[TROJAN FOLDER NAME]" = "[PATH TO TROJAN EXECUTABLE]"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\[TROJAN FILE NAME]\"Time" = ""
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TaskManager\"Task Service ID" = "[RANDOM HEXADECIMAL CHARACTERS]"
HKEY_CURRENT_USER\Software\Win7zip\"Uuid" = "[RANDOM HEXADECIMAL CHARACTERS]"
HKEY_ALL_USERS\.default\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\"2500" = "3"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\"2500" = "3"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\"2500" = "3"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\"ShowSuperHidden" = "0"

Directories

Trojan.Betabot may create the following directory or directories:

%ALLUSERSPROFILE%\Desktop Management Agent

Trending

Most Viewed

Loading...